CVE-2025-3935

ScreenConnect is like your business’s “remote access office,” letting you manage systems from one place. This vulnerability targets a built-in feature of ASP.NET called ViewState, which is meant to protect page/control information—if an attacker gets the server’s secret encryption keys, they can craft a message that tricks the server into running attacker-controlled code.

Think of it like forging an internal master key and then using it to slip a malicious note past the lock on a sealed envelope.

This matters if you run ScreenConnect (ConnectWise ScreenConnect) on-premises, including the version line up to and including 25.2.3 or earlier. The real-world risk is high because it’s confirmed in CISA’s KEV and exploitation is being reported.

However, the final takeover requires that an attacker already obtained privileged machine-level access to steal the specific encryption keys—so focus on whether your environment is likely to be reachable to attackers and protected against internal compromise, not just whether the software is exposed.

This is RED because CISA has added CVE-2025-3935 to its KEV catalog and active exploitation is confirmed. Once the attacker’s key-compromise step is achieved, this flaw can lead to remote code execution and full server control.

Do not treat this as a theoretical issue—treat it as an active threat and upgrade to the fixed version.

1. Confirm exposure.

   • Identify your installed ScreenConnect version.
   • This issue applies to ScreenConnect version 25.2.3 or earlier.

2. Apply the confirmed fix.

   • Upgrade ScreenConnect to 25.2.4 (or the latest stable release available) and ensure the service is restarted.
   • ConnectWise states that the 25.2.4 security patch removes the dependency on ViewState (disables ViewState), which addresses the underlying risk.

3. If upgrade is delayed (temporary mitigation).

   • Follow the vendor’s mitigation guidance from their ScreenConnect security bulletin/advisory for this patch.
   • If mitigations are not available for your setup, discontinue use of the product until you can remediate, per CISA KEV guidance.

4. Validate and hunt for signs of compromise.

   • After upgrade, review ScreenConnect-related logs and any web/application logs around the time of suspicious activity or alerts.
   • Check for evidence of unusual requests, unexpected service behavior, or indicators of machine/key compromise.

5. Timelines to track.

   • CISA remediation due date for KEV is 2025-06-23.

6. Ongoing monitoring.

   • Monitor for continued suspicious activity targeting ScreenConnect endpoints and for signs that attackers may have already moved beyond initial access (because the prerequisite for exploitation is key compromise, not just a public scan).

Severity is high (CVSS 8.1). The weakness is CWE-502 (Deserialization of Untrusted Data) in the context of ASP.NET Web Forms ViewState handling: ViewState is protected/encoded using machine keys, and if those keys are compromised, an attacker can craft a malicious ViewState payload that results in remote code execution.

Mechanism (from the findings): attackers who have privileged system-level access can obtain the machine keys; with those keys they can create and send a malicious data packet to the web server for ScreenConnect, resulting in full server control.

Exploitation status: CISA KEV lists this issue as actively exploited; CISA added it to its catalog on 2025-06-02 with a remediation due date of 2025-06-23. Additional reporting indicates exploitation is confirmed in the wild, and CISA ordered mitigations.

Exploit maturity: no public exploit code was found in the provided sources, but exploitation is still confirmed by KEV/real-world reporting, so the absence of public code does not reduce urgency.

About patch behavior: ConnectWise’s 25.2.4 patch disables ViewState and removes its dependency, addressing the platform behavior that makes the injection possible when machine keys are compromised.